What legal services does Dr Josianne Cardona Gatt provide in Malta?

Dr Josianne Cardona Gatt provides comprehensive legal, corporate, commercial, regulatory, licensing, gaming and iGaming, immigration, and Maltese citizenship & residency legal advisory services for local and international clients.

How can I schedule a legal consultation with the practice in Malta?

You can request a legal consultation through the website contact form, via email at cardonagatt.legal@gmail.com, or by calling +356 99826016.

Where is the legal practice of Dr Josianne Cardona Gatt located?

The practice is located at 16, Duke of Edinburgh Street, Hamrun, Malta, advising clients both locally in Malta and internationally across Europe and globally.

Does the practice assist international businesses establishing in Malta?

Yes, the practice offers complete cross-border and corporate setup assistance, including company incorporation, licensing, regulatory compliance, employment matters, and commercial contract drafting.

GDPR Compliance for Maltese Businesses: Practical Steps and Legal Obligations

Key Legal Takeaways

Personal data processing requires a documented lawful basis under Article 6 (e.g. consent, contract performance, legitimate interests).

Organizations must implement clear Privacy Notices and Cookie Policies communicating data subject rights.

Data protection breaches posing risks to individuals must be notified to the IDPC within 72 hours of becoming aware.

International data transfers outside the EEA require adequacy decisions or Standard Contractual Clauses (SCCs).

What are the Core Principles of Data Protection in Malta?

The GDPR establishes six fundamental data processing principles: lawfulness, fairness, and transparency; purpose limitation; data minimization; accuracy; storage limitation; and integrity and confidentiality. The data controller bears the burden of demonstrating accountability.

Businesses must assess whether they are acting as a Data Controller or Data Processor in each commercial engagement and conclude mandatory Data Processing Agreements (DPAs) meeting Article 28 standards.

The Role of the Information and Data Protection Commissioner (IDPC)

The IDPC is the national supervisory authority in Malta tasked with monitoring and enforcing GDPR compliance. The IDPC possesses investigatory powers, can order the suspension of data flows, and may levy significant administrative fines for non-compliance.

Data Breach Protocols and Subject Rights

Organizations must maintain robust incident response procedures. In the event of a security breach compromising personal data, notice must be lodged with the IDPC within 72 hours, and affected data subjects must be informed without undue delay where high risk is present.